CVE-2025-67875

ChurchCRM is an open-source church management system. A privilege escalation vulnerability exists in ChurchCRM prior to version 6.5.3. An authenticated user with specific mid-level permissions ("Edit Records" and "Manage Properties and Classifications") can inject a persistent Cross-Site Scripting (XSS) payload into an administrator's profile. The payload executes when the administrator views their own profile page, allowing the attacker to hijack the administrator's session, perform administrative actions, and achieve a full account takeover. This vulnerability is a combination of two separate flaws: an Insecure Direct Object Reference (IDOR) that allows any user to view any other user's profile, and a Broken Access Control vulnerability that allows a user with general edit permissions to modify any other user's record properties. Version 6.5.3 fixes the issue.

• CWE-79

• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjmExploit, Vendor Advisory
• https://github.com/ChurchCRM/CRM/security/advisories/GHSA-fcw7-mmfh-7vjmExploit, Vendor Advisory

Published

Dec 17, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-67869Rejected reason: Not used
• CVE-2025-6787The Smart Docs plugin for WordPress is vulnerable to Stored …5.4
• CVE-2025-67870Rejected reason: Not used
• CVE-2025-67871Rejected reason: Not used
• CVE-2025-67873Capstone is a disassembly framework. In versions 6.0.0-Alpha…7.8
• CVE-2025-67874ChurchCRM is an open-source church management system. Prior …6.5
• CVE-2025-67876ChurchCRM is an open-source church management system. A stor…5.4
• CVE-2025-67877ChurchCRM is an open-source church management system. Versio…8.8
• CVE-2025-6788A CWE-668: Exposure of Resource to Wrong Sphere vulnerabilit…5.3
• CVE-2025-67886Bitrix24 through 25.100.300 allows Remote Code Execution bec…6.3
• CVE-2025-678871C-Bitrix through 25.100.500 allows Remote Code Execution be…9.8
• CVE-2025-67888An issue was discovered in Control Web Panel (CWP) before 0.…7.3